Briefing · Thursday 12 November 2026 · 07:00 UTC
ScreenConnect panels used to spread remote-access malware
By CyberSIXT Briefing · from 73 reports by 16 outlets · Editorial policy
Since this morning1
New N-central zero-days work against N-able hotfix
The researcher behind Able2Shell has published new exploits that work on N-able's Hotfix 2, for the server and for Windows agents and probes.CyberSIXT N-able says the server flaw needs the non-default Legacy API and tells customers to disable it.CyberSIXT
Huntress said a threat actor used hijacked ConnectWise ScreenConnect panels on 11 November to install rogue remote-access clients and the SCKit toolkit on at least 288 hosts across 48 organisations.CyberSIXTSecurityOnline The incident is the main new development since Wednesday’s edition, which focused on different vulnerabilities and fixes.CyberSIXTSecurityOnline ConnectWise disabled five third-party extensions in about 400 partner environments, but has not identified how the panels were accessed or established the full scope.CyberSIXTSecurityOnline
Nitori says breach exposed records on up to 37.6 million people#
Nitori said a cyberattack on 9 November 2026 breached its management servers and exposed up to 37.6 million records.SecurityOnline The data includes customer names, addresses, phone numbers, email addresses, birthdates and genders, as well as company and contact details for enterprise buyers.SecurityOnline The retailer said the breach appears concentrated on domestic Japanese shoppers and procurement partners, with no evidence that international customer databases were exfiltrated.SecurityOnline Nitori reported the incident to Japan’s Personal Information Protection Commission and law enforcement, and said affected people will be notified by email and post.SecurityOnline
Telegram confirms it fixed Android remote-code execution flaw#
Security firm V12 demonstrated a Telegram for Android flaw that it said let a message run code on a recipient’s device.CyberSIXT Telegram said on 11 November that the issue had been fixed the previous day and that the fix had been deployed to all users earlier that day.CyberSIXT V12 published a video demonstration and a SHA-256 hash, but neither it nor Telegram has released technical details, a CVE or a version number.CyberSIXTSecurityOnline Telegram has not said whether the flaw was in the app’s new message apps feature, whether it affected other clients, or whether it was exploited before the fix.CyberSIXTSecurityOnline
Apache fixes remote-code execution flaw in HTTP/2 module#
Apache released version 2.4.71 to fix CVE-2026-119618, a critical-severity remote-code execution flaw in the mod_http2 module, The Hacker News reported.The Hacker News The flaw affects versions 2.4.55 through 2.4.70, and only servers with HTTP/2 enabled are affected.The Hacker News SANS ISC said the flaw involves a heap overflow during stream processing in the assign_headers function and that no working exploit had been published publicly.SANS ISC
Also
- Google Chrome. Google released Chrome 157.0.8103.78 for Windows, macOS and Linux, patching 83 vulnerabilities, including five critical-severity use-after-free flaws for which Google said there were no reported exploits in the wild at disclosure.SecurityOnline
- Vanderbilt. Vanderbilt University is restoring systems after a BYOD ransomware attack, while the university says it is still determining what data was accessed and has not confirmed the group’s claim that it obtained more than one million Social Security numbers.Malwarebytes
- OpenPrinting. OpenPrinting fixed CVE-2026-123747 in pappl-retrofit, a path traversal flaw affecting versions 1.0b2 and earlier, after a proof-of-concept was published; the source reported no confirmed exploitation.SecurityOnline
- ManageEngine. Zoho issued patches on 10 and 11 November for eight high-severity flaws in DDI Central and ADAudit Plus, with no confirmed exploitation reported.SecurityOnline
- Chinese surveillance. Dark Reading reported that leaked documents describe a Chinese government programme using data-mining systems to monitor overseas ethnic-Chinese communities and identify people in Taiwan’s semiconductor sector for potential influence operations.Dark Reading
Watching
ConnectWise has not disclosed the initial access vector or the full scope of the ScreenConnect intrusions.CyberSIXTSecurityOnline